CVE-2022-3474

CVE-2022-3474 describes a credential handling flaw in Google Bazel versions prior to 5.3.2 and 4.2.3, where the remote assets API inadvertently sends all user-provided credentials instead of only those required for a specific request. This vulnerability has a CVSS score of 4.3 (Medium), indicating a low-complexity attack that could lead to a partial compromise of confidentiality if an authenticated attacker exploits it over a network. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE. Organizations are advised to upgrade to Bazel versions 5.3.2 or 4.2.3 and later to mitigate this risk.